Risk Assessment
Risk Assessment is the tenant-level answer to “how bad is it, and why”. The Dashboard gives you a single number; this page decomposes that number into the bands it came from, the factors driving it, and the specific datastores and identities to go work on.
There is nothing to configure here and no actions to take. It is a read-and-triage board, and every route out of it leads to a detail drawer somewhere else. How a score is actually computed is in Risk engine.
Risk assessments are produced automatically whenever a datastore is scanned. Until at least one scan has completed the page shows an empty state rather than zeroes, because a score of zero across nothing scanned is not good news, it is no news.
The stat row
Section titled “The stat row”| Tile | What it means |
|---|---|
| Overall Risk Score | Tenant posture out of 100, coloured by band, with a confidence percentage underneath |
| Total Datastores | The inventory, annotated with how many have actually been scanned when that is fewer |
| High Risk | Critical and High combined |
| Medium Risk | |
| Low Risk | Low and Minimal combined |
Two things to read carefully.
The confidence figure is not a risk level. It is how much Argus trusts its own score, driven by how much of your estate it managed to sample and how confident the underlying detections were. A high risk score at low confidence means “this looks bad and we are guessing”; the fix is more coverage, not more remediation. See Confidence scoring.
The scanned annotation on Total Datastores is the honesty check. If it says 40 scanned out of 600, every other number on this page describes those 40.
Risk Distribution
Section titled “Risk Distribution”A donut of scanned datastores across all five bands: Critical, High, Medium, Low, Minimal, with the scanned count shown beside the heading. Bands with nothing in them are omitted rather than drawn as empty slices.
This is the fuller version of the three-way High/Medium/Low split on the Dashboard widget. Use it to judge shape rather than volume: a healthy estate is heavily weighted toward Minimal and Low with a short Critical tail. A flat distribution usually means classification is still catching up, not that everything is equally dangerous.
Top Risk Drivers
Section titled “Top Risk Drivers”The most useful panel on the page, and the one that answers “why”. Instead of listing bad datastores, it lists the factors contributing most of your total risk right now, each with a contribution percentage and a bar scaled against the largest driver so the top one fills the row.
Each driver expands to the datastores affected by it, with their individual scores, and clicking one opens that datastore’s detail drawer.
That is what makes this a worklist rather than a chart. If “public sensitive data” is carrying a third of your risk, you do not have fifty problems, you have one problem in a handful of places, and expanding the driver hands you the exact list. Fixing by driver is almost always fewer actions than fixing by datastore.
When there are no drivers, the panel says so explicitly rather than rendering an empty chart. That is a real result, not a loading state.
Top Risk Datastores
Section titled “Top Risk Datastores”Your datastore triage queue, worst first.
| Column | Notes |
|---|---|
| Datastore | |
| Risk Score | Out of 100, coloured by band |
| Status | Lifecycle state |
| Alerts | Open alerts against it |
| Violations | Open policy violations against it |
Alerts and Violations sit next to the score on purpose: a high score with no alerts and no violations is a datastore whose content is sensitive, while a high score with several of each is one that is also breaking your rules. The second kind is more urgent and easier to justify spending time on. Rows open the datastore drawer, covered in Datastores.
Top Risk Identities
Section titled “Top Risk Identities”The same treatment for principals: Identity, Risk Score, how many Datastores it reaches, and its open Alerts. Rows open the identity drawer.
Having both tables side by side is deliberate. Datastore risk tells you what is worth stealing; identity risk tells you who could steal it. A Critical datastore reachable only by two tight roles is a different problem from a Medium one that forty stale principals can read, and you cannot see that from either table alone.
If this table is empty it usually means IAM discovery has not run rather than that you have no identity risk. See Identity & Access.
Where to go from here
Section titled “Where to go from here”- A specific datastore: Datastores, whose drawer carries the per-store risk drivers and a risk history chart with the events that moved the score.
- A specific principal: Identity & Access, whose drawer carries blast radius and permission utilization.
- The rules being broken: Policies.
- What to actually do about it: Recommendations and Remediation.